MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 eeeb29513e624adb88d3c2e9f89379361aa356001dc338cb6ec9034a48bdc2cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
njrat
Vendor detections: 6
| SHA256 hash: | eeeb29513e624adb88d3c2e9f89379361aa356001dc338cb6ec9034a48bdc2cd |
|---|---|
| SHA3-384 hash: | eddf6460950d7d6f5526408d0ce388192029323b0494263435655870fc3c7def5efdba4be10b75cc57b94a44b603862c |
| SHA1 hash: | 6776ba15540b3ec7d8a1f244392aad0336e5e395 |
| MD5 hash: | 7f71ff578e8887674064e624769ffc69 |
| humanhash: | pizza-glucose-seven-berlin |
| File name: | Quotation.vbs |
| Download: | download sample |
| Signature | njrat |
| File size: | 1'315 bytes |
| First seen: | 2021-08-08 06:08:50 UTC |
| Last seen: | Never |
| File type: |  vbs |
| MIME type: | text/plain |
| ssdeep | 24:AP/mnvPmnoy9gy35SNihPH3bqreIqmQHhXvAN5mPT+mP1EeYI3SDKV:0GPaoy9gswCPbqrdcAN54i81EeYI3D |
| Threatray | 90 similar samples on MalwareBazaar |
| TLSH | T1C321D0146A8BE1359D01D6C25AED4A61F26E62AAF4744471363BC118D07E4EE35C3A8F |
| Reporter |  abuse_ch |
| Tags: | NjRAT RAT vbs |
abuse_ch
NjRAT payload URLs:http://transfer.sh/1himUHb/ball_bypass_llllooollllll444119990000.txt
http://transfer.sh/1Ag5gVG/defender_llllllllllllllloollll56765666.txt
Intelligence
File Origin
# of uploads :
1
# of downloads :
406
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
DNS request
Connection attempt
Sending an HTTP GET request
Sending a UDP request
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Signature
Creates an undocumented autostart registry key
Obfuscated command line found
Sigma detected: Suspicious PowerShell Command Line
VBScript performs obfuscated calls to suspicious functions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Threat name:
Script.Downloader.Heuristic
Status:
Malicious
First seen:
2021-08-08 06:09:04 UTC
AV detection:
2 of 46 (4.35%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
suspicious
Similar samples:
+ 80 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
suricata
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Blocklisted process makes network request
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
Malware Config
Dropper Extraction:
http://transfer.sh/1himUHb/ball_bypass_llllooollllll444119990000.txt
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.